urlscan.io logo urlscan.io
SecurityTrails logo

rh.rocahead.com Open in urlscan Pro
34.238.74.91  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://crazibounty.o18.click/c?o=5272624&m=2718&a=82560&aff_sub1=%7Banando%7D
Effective URL: http://rh.rocahead.com/banned.php?reason=8&o=65&c=countryid
Submission: On July 22 via manual from IN
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 3 countries across 4 domains to perform 3 HTTP transactions. The main IP is 34.238.74.91, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is rh.rocahead.com.
This is the only time rh.rocahead.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 13.232.0.190 16509 (AMAZON-02)
1 2 2a05:d018:e36... 16509 (AMAZON-02)
1 2a05:d018:483... 16509 (AMAZON-02)
1 2 34.238.74.91 14618 (AMAZON-AES)
3 3
Apex Domain
Subdomains		 Transfer
2 rocahead.com
rh.rocahead.com
2 KB
2 mysslgo.com
mysslgo.com
5 KB
1 gdmconvtrck.com
gdmconvtrck.com
1 KB
1 o18.click
crazibounty.o18.click
1 KB
3 4
Domain Requested by
2 rh.rocahead.com 1 redirects gdmconvtrck.com
2 mysslgo.com 1 redirects
1 gdmconvtrck.com mysslgo.com
1 crazibounty.o18.click 1 redirects
3 4

This site contains no links.

Subject Issuer Validity Valid
mstrck01a.com
Amazon		 2020-03-18 -
2021-04-18		 a year crt.sh
gdmconvtrck.com
Amazon		 2020-03-21 -
2021-04-21		 a year crt.sh

This page contains 1 frames:

Primary Page: http://rh.rocahead.com/banned.php?reason=8&o=65&c=countryid
Frame ID: 6BEA3828187E5C9BD0F357839408C56D
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://crazibounty.o18.click/c?o=5272624&m=2718&a=82560&aff_sub1=%7Banando%7D HTTP 302
    https://mysslgo.com/?a=107778&c=213986&s2=D-5272624-1595435540-PhGleOx400507&s1=82560 Page URL
  2. https://mysslgo.com/?a=107778&c=222464&oc=111521&sr=t&so=78149&sc=10887815&rc=24_103326&s1=82560... HTTP 302
    https://rh.rocahead.com/track/MTI1LjE2MDMuMzUwLjcxOS4wLjAuMC4wLjAuMC4wLjA?_ocid=96581b6f6655414f99f9... HTTP 302
    http://rh.rocahead.com/banned.php?reason=8&o=65&c=countryid Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

3
Requests

67 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

3
IPs

3
Countries

3 kB
Transfer

3 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://crazibounty.o18.click/c?o=5272624&m=2718&a=82560&aff_sub1=%7Banando%7D HTTP 302
    https://mysslgo.com/?a=107778&c=213986&s2=D-5272624-1595435540-PhGleOx400507&s1=82560 Page URL
  2. https://mysslgo.com/?a=107778&c=222464&oc=111521&sr=t&so=78149&sc=10887815&rc=24_103326&s1=82560&s2=D-5272624-1595435540-PhGleOx400507&vt=1595435540941&h=190ea80900992f6b103e9825c7289f2b62b9a52a&req=https%3A%2F%2Fmysslgo.com%2F%3Fa%3D107778%26c%3D213986%26s2%3DD-5272624-1595435540-PhGleOx400507%26s1%3D82560&us=ca22256a35c84f05a03d9838493f55a8 HTTP 302
    https://rh.rocahead.com/track/MTI1LjE2MDMuMzUwLjcxOS4wLjAuMC4wLjAuMC4wLjA?_ocid=96581b6f6655414f99f9afa738fcb63a14426&subaff=107778 HTTP 302
    http://rh.rocahead.com/banned.php?reason=8&o=65&c=countryid Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://crazibounty.o18.click/c?o=5272624&m=2718&a=82560&aff_sub1=%7Banando%7D HTTP 302
  • https://mysslgo.com/?a=107778&c=213986&s2=D-5272624-1595435540-PhGleOx400507&s1=82560

3 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
mysslgo.com/
Redirect Chain
  • https://crazibounty.o18.click/c?o=5272624&m=2718&a=82560&aff_sub1=%7Banando%7D
  • https://mysslgo.com/?a=107778&c=213986&s2=D-5272624-1595435540-PhGleOx400507&s1=82560
2 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://mysslgo.com/?a=107778&c=213986&s2=D-5272624-1595435540-PhGleOx400507&s1=82560
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a05:d018:e36:3930:f015:776b:eef4:fb5a Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
ff46ed2caff0fc99f52d4f65af9b1b4c7fc2e75c0fdf091e869aa4e208a95452

Request headers

:method
GET
:authority
mysslgo.com
:scheme
https
:path
/?a=107778&c=213986&s2=D-5272624-1595435540-PhGleOx400507&s1=82560
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
date
Wed, 22 Jul 2020 16:32:20 GMT
content-type
text/html;charset=utf-8
server
nginx
vary
Accept-Encoding Accept-Encoding
cache-control
no-cache, must-revalidate
pragma
no-cache
expires
Sat, 1 May 2020 12:00:00 GMT
access-control-allow-origin
*
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With,X-Auth,Pasha-Jlob
content-encoding
gzip

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, no-transform, max-age=0, post-check=0, pre-check=0
Content-Type
text/html; charset=UTF-8
Date
Wed, 22 Jul 2020 16:32:20 GMT
Expires
Mon, 26 Jul 1997 05:00:00 GMT
Location
https://mysslgo.com/?a=107778&c=213986&s2=D-5272624-1595435540-PhGleOx400507&s1=82560
Pragma
no-cache
Sec-Fetch-Mode
cors
Sec-Fetch-Site
cross-site
Server
Apache/2.4.39 (Amazon) PHP/5.6.40
Set-Cookie
NTI3MJYYNHWXNJUUMJMXLJE0MI4ZNG=1595435540.7622; expires=Thu, 23-Jul-2020 16:32:20 GMT; Max-Age=86400; path=/ 5272624=D-5272624-1595435540-PhGleOx400507; expires=Fri, 21-Aug-2020 16:32:20 GMT; Max-Age=2592000; path=/ ____global_tid=D-5272624-1595435540-PhGleOx400507; expires=Fri, 21-Aug-2020 16:32:20 GMT; Max-Age=2592000; path=/ 5272624__2=D-5272624-1595435540-PhGleOx400507; expires=Fri, 21-Aug-2020 16:32:20 GMT; Max-Age=2592000; path=/; SameSite=None; Secure ____global_tid__2=D-5272624-1595435540-PhGleOx400507; expires=Fri, 21-Aug-2020 16:32:20 GMT; Max-Age=2592000; path=/; SameSite=None; Secure
X-Powered-By
PHP/5.6.40
X-Response-Time
0.001807
X-Time-423
0.0009160041809082
X-Time-479
0.0010700225830078
Content-Length
0
Connection
keep-alive
user
gdmconvtrck.com/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://gdmconvtrck.com/user?a=107778&c=222464
Requested by
Host: mysslgo.com
URL: https://mysslgo.com/?a=107778&c=213986&s2=D-5272624-1595435540-PhGleOx400507&s1=82560
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a05:d018:483:6110:ec0e:b108:7f12:f2f9 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
0871e5ffbca7283bee63288e1de6ab06dc8bb6c3d2d31b18a44ca5ff45c9c405

Request headers

Referer
https://mysslgo.com/?a=107778&c=213986&s2=D-5272624-1595435540-PhGleOx400507&s1=82560
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 22 Jul 2020 16:32:21 GMT
content-encoding
gzip
server
nginx
status
200
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
text/javascript;charset=utf-8
access-control-allow-origin
*, *
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With,X-Auth,Pasha-Jlob
expires
Sat, 1 May 2020 12:00:00 GMT
Primary Request Cookie set banned.php
rh.rocahead.com/
Redirect Chain
  • https://mysslgo.com/?a=107778&c=222464&oc=111521&sr=t&so=78149&sc=10887815&rc=24_103326&s1=82560&s2=D-5272624-1595435540-PhGleOx400507&vt=1595435540941&h=190ea80900992f6b103e9825c7289f2b62b9a52a&re...
  • https://rh.rocahead.com/track/MTI1LjE2MDMuMzUwLjcxOS4wLjAuMC4wLjAuMC4wLjA?_ocid=96581b6f6655414f99f9afa738fcb63a14426&subaff=107778
  • http://rh.rocahead.com/banned.php?reason=8&o=65&c=countryid
46 B
824 B 		Document
General
Check archive.org
Download Go to
Full URL
http://rh.rocahead.com/banned.php?reason=8&o=65&c=countryid
Requested by
Host: gdmconvtrck.com
URL: https://gdmconvtrck.com/user?a=107778&c=222464
Protocol
HTTP/1.1
Server
34.238.74.91 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-238-74-91.compute-1.amazonaws.com
Software
Apache/2.4.41 (Ubuntu) /
Resource Hash
de9350a2ade7022b7d7cfce9da0cab87e5a4b82b35cef0e6353c8401aa934f21

Request headers

Host
rh.rocahead.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Cookie
AWSALB=En155ML4H2m1R3cXJMua+eQ49H/ex0JUzYTg66nv9cWa0UolF6GEk5TpljTXX6k9oz/iHmqXRaLHpvYTKybLBJqTTOELx1+6efe8MGnjcUNWdhRQUvVkqXFM6Thq; PHPSESSID=o78nacr2ra579a5it5bv7n1781
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://mysslgo.com/?a=107778&c=213986&s2=D-5272624-1595435540-PhGleOx400507&s1=82560

Response headers

Date
Wed, 22 Jul 2020 16:32:22 GMT
Content-Type
text/html; charset=UTF-8
Content-Length
66
Connection
keep-alive
Set-Cookie
AWSALB=JH6NO/StjNQXyfLw7A4wB4JR1+Vfm7Br0sIei/pcsJ/5zc0OM6EHUNpzhh1sRoNfBdDQ0WiPb1zdktPGn0lL36IGY1TRBZuqz7i2B9egxYvIIs0r7XgeIij3f0HgosgycVkkDgvm57xKWnhh3Zq7X5jB8ouuZMWrwqPJi+B4n7VmGCem1/jhsRxFwzTDqQ==; Expires=Wed, 29 Jul 2020 16:32:21 GMT; Path=/ AWSALBCORS=JH6NO/StjNQXyfLw7A4wB4JR1+Vfm7Br0sIei/pcsJ/5zc0OM6EHUNpzhh1sRoNfBdDQ0WiPb1zdktPGn0lL36IGY1TRBZuqz7i2B9egxYvIIs0r7XgeIij3f0HgosgycVkkDgvm57xKWnhh3Zq7X5jB8ouuZMWrwqPJi+B4n7VmGCem1/jhsRxFwzTDqQ==; Expires=Wed, 29 Jul 2020 16:32:21 GMT; Path=/; SameSite=None
Server
Apache/2.4.41 (Ubuntu)
Vary
Accept-Encoding
Content-Encoding
gzip

Redirect headers

status
302
date
Wed, 22 Jul 2020 16:32:21 GMT
content-type
text/html; charset=UTF-8
content-length
0
location
http://rh.rocahead.com/banned.php?reason=8&o=65&c=countryid
set-cookie
AWSALB=En155ML4H2m1R3cXJMua+eQ49H/ex0JUzYTg66nv9cWa0UolF6GEk5TpljTXX6k9oz/iHmqXRaLHpvYTKybLBJqTTOELx1+6efe8MGnjcUNWdhRQUvVkqXFM6Thq; Expires=Wed, 29 Jul 2020 16:32:21 GMT; Path=/ AWSALBCORS=En155ML4H2m1R3cXJMua+eQ49H/ex0JUzYTg66nv9cWa0UolF6GEk5TpljTXX6k9oz/iHmqXRaLHpvYTKybLBJqTTOELx1+6efe8MGnjcUNWdhRQUvVkqXFM6Thq; Expires=Wed, 29 Jul 2020 16:32:21 GMT; Path=/; SameSite=None; Secure PHPSESSID=o78nacr2ra579a5it5bv7n1781; path=/ offerit_unique_735_65_85=MTI1LjEzMTguNjUuODUuMC4wLjAuMC4wLjYxMzUyMy4wLjA; Max-Age=86400; Expires=Thursday, 23 Jul 2020 17:32:21 BST; path=/; domain=rocahead.com; Secure; SameSite=None ocode_735_85=MTI1LjEzMTguNjUuODUuMC4wLjAuMC4wLjYxMzUyMy4wLjA; Max-Age=2592000; Expires=Friday, 21 Aug 2020 17:32:21 BST; path=/; domain=rocahead.com; Secure; SameSite=None ocode_735=MTI1LjEzMTguNjUuODUuMC4wLjAuMC4wLjYxMzUyMy4wLjA; Max-Age=2592000; Expires=Friday, 21 Aug 2020 17:32:21 BST; path=/; domain=rocahead.com; Secure; SameSite=None offerit_735_85_cookie=https%3A%2F%2Fmysslgo.com%2F%3Fa%3D107778%26amp%3Bc%3D213986%26amp%3Bs2%3DD-5272624-1595435540-PhGleOx400507%26amp%3Bs1%3D82560; Max-Age=2592000; Expires=Friday, 21 Aug 2020 17:32:21 BST; path=/; domain=rocahead.com; Secure; SameSite=None offerit_735_85=MTI1LjEzMTguNjUuODUuMC4wLjAuMC4wLjYxMzUyMy4wLjA|||85f186a15a85bc7.55517215; Max-Age=2592000; Expires=Friday, 21 Aug 2020 17:32:21 BST; path=/; domain=rocahead.com; Secure; SameSite=None
server
Apache/2.4.39 (Ubuntu)
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma
no-cache
access-control-allow-origin
*

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Domain/Path Name / Value
rh.rocahead.com/ Name: AWSALB
Value: JH6NO/StjNQXyfLw7A4wB4JR1+Vfm7Br0sIei/pcsJ/5zc0OM6EHUNpzhh1sRoNfBdDQ0WiPb1zdktPGn0lL36IGY1TRBZuqz7i2B9egxYvIIs0r7XgeIij3f0HgosgycVkkDgvm57xKWnhh3Zq7X5jB8ouuZMWrwqPJi+B4n7VmGCem1/jhsRxFwzTDqQ==
rh.rocahead.com/ Name: PHPSESSID
Value: o78nacr2ra579a5it5bv7n1781